PT-2024-31387 · Amazon · Aws Cloud Development Kit

T0Bst4R · Published 2024-08-27 · Updated 2024-08-28 · CVE-2024-45037

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AWS Cloud Development Kit (CDK) versions 2.142.0 through 2.148.0

Description The issue in AWS Cloud Development Kit (CDK) can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application uses the "RestApi" construct with "CognitoUserPoolAuthorizer" as the authorizer and uses authorization scopes to limit access, authenticated Cognito users may gain unintended access to protected API resources or methods, leading to potential data disclosure and modification issues.

Recommendations Upgrade your AWS CDK version to 2.148.1 or newer and re-deploy your application(s) to address this issue. If you are using older CDK versions before 2.142.0, you are not affected by this issue, however it is recommended to upgrade to the latest version to receive the latest features and fixes. Confirm whether your application(s) is affected by searching for "CognitoUserPoolsAuthorizer" in your CDK application. If it is referenced inside the "RestApi" construct, and the "RestApi" resource or method utilize authorization scopes to limit access, and you deployed your applications using the impacted versions of CDK, your application is affected.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-45037

GHSA-QJ85-69XF-2VXQ

Affected Products

Aws Cloud Development Kit

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45037.json · Exploit
• https://github.com/aws/aws-cdk/commit/4bee768f07e73ab5fe466f9ad3d1845456a0513b · Patch
• https://github.com/aws/aws-cdk/security/advisories/GHSA-qj85-69xf-2vxq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qj85-69xf-2vxq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45037 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45037 · Vendor Advisory
• https://github.com/aws/aws-cdk · Note
• https://github.com/aws/aws-cdk/releases/tag/v2.148.1 · Note
• https://twitter.com/VulmonFeeds/status/1828534709766226352 · Twitter Post
• https://docs.aws.amazon.com/cdk/v2/guide/home.html · Note
• https://twitter.com/CVEnew/status/1828503199386353772 · Twitter Post
• https://t.me/cvedetector/4273 · Telegram Post